Electronic Transactions Act, Act, Act 772 ARRANGEMENT OF SECTIONS. Object and scope of the Act

Transcription

1 Electronic Transactions Act, Act, Act 772 Section 1. Object of the Act 2. Application 3. Scope of Act 4. Exclusion ARRANGEMENT OF SECTIONS Object and scope of the Act Electronic transactions 5. Recognition of electronic message 6. Original writing 7. Admissibility and evidential weight of electronic records 8. Retention of electronic records 9. Secure electronic records 10. Digital signature 11. Equal treatment of digital signatures 12. Signing of an electronic record 13. Conduct of a person relying on a digital signature 14. Recognition of electronic certificates and digital signatures 15. Notarisation, acknowledgement and certification 16. Other requirements 17. Automated transactions 18. Despatch of electronic record 19. Receipt of electronic record 20. Expression of intent or other statement 21. Attribution of electronic records to originator 22. Acknowledgement of receipt of electronic record 23. Formation and validity of agreements 24. Variation by agreement between parties Electronic government services 25. Acceptance of electronic filing and issuing of documents 26. Public agency and electronic records Publication in electronic format

2 Electronic Transactions Act, Act, Certifying Agency 28. Prohibited acts 29. Provision of authentication encryption services 30. Certifying Agency 31. Functions of the Certifying Agency 32. Revocation of suspension of licence 33. Surrender of licence 34. Recognition of foreign certifying authorities 35. Repository of digital signatures 36. Register of licence holders 37. Restrictions of disclosure of information 38. Application for licence 39. Grant of licence 40. Display of licence 41. Duties of licensed entities 42. Renewal of licence 43. Procedure for grant or rejection of renewal of licence 44. Notification of adverse event 45. Procedures to be followed by licensed person Consumer protection 46. Scope of application 47 Information to be provided 48. Performance 49. Grace period 50. Unsolicited goods, services or communications 51. Liability for misuse of electronic payment medium 52. Electronic payment medium lists prohibited 53. Applicability of foreign law 54. Non-exclusion Protected computers and critical database 55. Protected computer 56. Identification of critical electronic record and critical databases 57. Scope of critical database protection 2

3 Electronic Transactions Act, Act, Act Registration of critical databases 59. Management of critical databases 60. Restrictions on disclosure of information 61. Right of inspection 62. Non-compliance with Act Domain name registry 63. Establishment of Registry 64. Functions of the Registry 65. Duties of the Registry 66. Licensing of registrars and registries 67. Governing Body of the Domain Name Registry 68. Tenure of office of members 69. Meetings of the Board 70 Disclosure of interest 71. Appointment of committees 72. Dispute Resolution Committee 73. Powers of the Dispute Resolution Committee 74. Allowances 75 The Executive Director 76. Functions of the Executive Director 77. Appointment of other staff 78. Funds of the Registry 79. Accounts and audit 80. Annual report and other reports 81. Resolution of disputes Appeal Tribunal 82. Establishment of the Information Communication Technology Tribunal 83. Composition of the Tribunal 84. Rules of Procedure of Tribunal 85. Appeals against decisions of the Agency or Dispute Resolution Committee 86. Decision of Tribunal 87. Appeals against the decisions of the Tribunal 3

4 Electronic Transactions Act, Act, Industry Forum 88. Establishment of Industry Forum 89. Industry code Liability of service providers and intermediaries 90. Mere conduit 91. Electronic record transmission 92. Hosting 93. Information location tools 94. Take-down notification 95. Monitoring and compliance 96. Limitations and prohibited acts 96. Savings Cyber inspectors 98. Powers of law enforcement officers 99. Law enforcement officer and third party assistance 100. Preservation of evidence 101. Contents of electronic communications in electronic storage 102. Disclosure of electronic information 103. Provider to keep logs and records 104. Backup preservation 105. Customer challenge 106. Inadmissible Evidence 107. Stealing 108. Appropriation 109. Representation 110. Charlatanic advertisement 111. Attempt to commit crimes 112. Aiding and abetting 113. Duty to prevent felony 114. Conspiracy 115. Forgery 116. Intent Cyber offences 4

5 Electronic Transactions Act, Act, Act Criminal negligence 118. Access to protected computer 119. Obtaining electronic payment medium falsely 120. Electronic trafficking 121. Possession of electronic counterfeit-making equipment 122. General offence for fraudulent electronic fund transfer 123. General provision for cyber offences 124. Unauthorised access or interception 125. Unauthorised interference with electronic record 126. Unauthorised access to devices 127. Unauthorised circumvention 128. Denial of service 129. Unlawful access to stored communications 130. Unauthorised access to computer programme or electronic record 131. Unauthorised modification of computer programme or electronic record 132. Unauthorsed disclosure of access code 133. Offence relating to national interest and security 134. Causing a computer to cease to function 135. Illegal devices 136. Child pornography 137. Confiscation of assets 138. Order for compensation 139. Ownership of programme or electronic record 140. Conviction and civil claims Miscellaneous matters 141. Record and access to seized electronic record 142. Territorial scope of offences under this Act 143. Regulations 144. Interpretation THE SEVEN HUNDRED AND SEVENTY-SECOND 5

6 Electronic Transactions Act, 2008 ACT OF THE PARLIAMENT OF THE REPUBLIC OF GHANA ENTITLED ELECTRONIC TRANSACTIONS ACT, 2008 AN ACT to provide for the regulation of electronic communications and related transactions and to provide for connected purposes. DATE OF ASSENT: 18th December, ENACTED by the President and Parliament: Object of the Act Object of the Act 1. (1) The object of this Act is to provide for and facilitate electronic communications and related transactions in the public interest, and to (a) remove and prevent barriers to electronic communications and transactions; (b) promote legal certainty and confidence in electronic communications and transactions; (c) promote e-government services and electronic communications and transactions with public and private bodies, institutions and citizens; (d) develop a safe, secure and effective environment for the consumer, business and the Government to conduct and use electronic transactions; (e) promote the development of electronic transaction services responsive to the needs of consumers; 6

7 Electronic Transactions Act, 2008 Act 772 (f) ensure that, in relation to the provision of electronic transactions services, the special needs of vulnerable groups and communities and persons with disabilities are duly taken into account; (g) ensure compliance with accepted international technical standards in the provision and development of electronic communications and transactions; (h) ensure efficient use and management of the country domain name space; and (i) ensure that the interest and image of the Republic are not compromised through the use of electronic communications. Application 2. This Act applies to electronic transactions and electronic records of every type. Scope of Act 3. (1) This Act shall not be interpreted so as to exclude statute law or the principles of the common law being applied to, recognising or accommodating electronic transactions, electronic records or any other matter provided for in this Act. (2) Unless otherwise provided, this Act shall not be construed as (a) requiring a person to generate, communicate, produce, process, send, receive, record, retain, store or display information, document or signature by or in electronic form; or (b) prohibiting a person from establishing requirements in respect of the manner in which that person will accept electronic records. (3) This Act does not limit the operation of law that expressly authorises, prohibits or regulates the use of electronic records and any legal requirement law for information to be posted, displayed or transmitted in a specified manner. Exclusion 4. This Act does not apply to: (a) a negotiable instrument as defined in the Bill of Exchange Act, 1961 (Act 55); (b) the grant of a power-of-attorney 7 under the Powers of Attorney

8 Electronic Transactions Act, 2008 Act, 1998 (Act 549); (c) a trust as defined in the Trustees Incorporation Act, 1962 (Act 106); (d) a will as defined in the Wills Act, 1971 (Act 360); (e) a contract for the sale or conveyance of immovable property or any interest in the immovable property; (f) bills of lading; (g) documents required for the registration of a company, Partnership or sole proprietorships; (h) the swearing of affidavits or statutory declarations before a Commissioner for Oaths or Notary Public; and (i) any class of documents or transactions that may be notified by Gazette. Electronic transactions Recognition of electronic message 5. Except as provided in this Act, where a law provides that information or any other matter shall be in writing, typewritten or in printed form, the requirement shall be deemed to have been satisfied if the information or matter is (a) rendered or made available in an electronic form, (b) accessible, and (c) capable of being retained for a subsequent reference despite the contrary intention in the law. Original writing 6. (1) Where a law requires information to be presented or retained in its original form, the requirement shall be deemed to have been satisfied by an electronic record if (a) there is reliable assurance of the integrity of the electronic record, and (b) the electronic record is capable of being displayed to the person to whom it is to be presented. (2) The criteria to assess integrity shall be whether the information has remained complete and unaltered and the information shall be assessed taking into consideration the relevant circumstances for which the information was generated to determine the standard of reliability. 8

9 Electronic Transactions Act, 2008 Act 772 Admissibility and evidential weight of electronic records 7. (1) The admissibility of an electronic record shall not be denied as evidence in legal proceedings except as provided in this Act. (2) In assessing the evidential weight of an electronic record the Court shall have regard to (a) the reliability of the manner in which the electronic record was generated, displayed, stored or communicated, (b) the reliability of the manner in which the integrity of the information was maintained, (c) the manner in which its originator was identified, and (d) any other facts that the Court may consider relevant. Retention of electronic records 8. (1) Where a law requires that a document, record or information shall be retained, that requirement is deemed to have been met if the document, record or information is held in electronic form and (a) is accessible, (b) is capable of retention for subsequent reference, (c) is retained in the format in which it was generated, sent or received, or in a format which can be demonstrated to represent accurately the information generated, sent or received, and (d) is retained to enable the identification of the origin and destination of the electronic record and the date and time when it was sent or received. (2) The document, record or information shall be kept in electronic form for at least six years. (3) An obligation to retain a document, record or information does not extend to information which is only to enable the message to be sent or received. Secure electronic record 9. (1) Where a security procedure has been applied to an electronic record at a specific point in time, the record is deemed to be a secure electronic record during the period when the security procedure was applied. (2) An unauthorised alteration of the security procedure renders the record invalid. 9

10 Electronic Transactions Act, 2008 (3) An alteration is unauthorised if it is done by a person without the lawful authority of the person who originally applied the security procedure. Digital signature 10. (1) Where a law requires the signature of a person, that requirement is deemed to be satisfied in relation to an electronic record if a digital signature is used. (2) A digital signature is deemed to be authentic if (a) the means of creating the digital signature is, within the context in which it is used, linked to the signatory and not to another person, (b) the means of creating the digital signature was, at the time of signing, under the control of the signatory and not another person without duress or undue influence, and (c) an alteration to the digital signature, made after the time of signing, is detectable. (3) Subsection (2) does not limit the right of a person (a) to prove the authenticity of a digital signature in any other way, or (b) to adduce evidence in respect of the non-authenticity of a digital signature. Equal treatment of digital signatures 11. Except as provided in this Act, the provisions of this Act do not exclude, restrict, or deprive of legal effect, any method of creating a digital signature which (a) satisfies the requirements of this Act, (b) meets the requirements of other statutory provision, or (c) is provided for under a contract. Signing of an electronic record 12. A person may sign an electronic record by affixing a personal digital signature or using any other recognized, secure and verifiable mode of signing agreed by the parties or recognized by the industry to be safe, reliable and acceptable. Conduct of a person relying on a digital signature 10

11 Electronic Transactions Act, 2008 Act A person who relies on a digital signature shall bear the legal consequences of failure to (a) take reasonable steps to verify the authenticity of a digital signature, or (b) take reasonable steps where a digital signature is supported by a certificate, to (i) verify the validity of the certificate, or (ii) observe any limitation with respect to the certificate. Recognition of digital certificates and digital signatures 14. (1) Unless otherwise prescribed by law, a person may determine the digital signature, certificate or authentication the person will use. (2) The Minister may recognise a digital signature, certificate or authentication of a foreign information security service provider for use by a public servant by notice published in the Gazette. Notarisation, acknowledgement and certification 15. (1) Where a law requires a signature, statement or document to be notarised, acknowledged, verified or made under oath, that requirement is deemed to be satisfied if the electronic signature of the person authorised to perform those acts is affixed to an electronic record. (2) Where a law requires or permits a person to provide a certified copy of a document and the document exists in paper or in another physical form, that requirement is deemed to be satisfied if an electronic copy of the document is certified to be a true copy by using the electronic signature of the certifying person. Other requirements 16. (1) A requirement in law for multiple copies of a document to be submitted to a single addressee at the same time, is satisfied by the submission of a single electronic record that is capable of being reproduced by the addressee. (2) Where a corporate seal is required to be affixed to a document, that requirement is deemed to be satisfied if the electronic signature of the corporate body is affixed to the electronic record in accordance with the provisions relating to the use of the corporate seal. Automated transactions 17. (1) An automated transaction is valid even if an electronic agent 11

12 Electronic Transactions Act, 2008 is involved at any stage of its formation. (2) A party interacting with an electronic agent to make an agreement is not bound by the terms of the agreement unless the terms were capable at first of being accessed by the party prior to the formation of the contract. (3) An electronic contract is not valid where an individual interacts directly with the electronic agent and has made a material error during the creation of an electronic record and (a) the electronic agent did not provide that person with an easy opportunity to prevent or correct the error, (b) that person notifies the party creating the electronic record of the error as soon as practicable after noticing it, (c) that person takes reasonable steps to return to the previous situation, and (d) that person has not used or received material benefit or value from performance received from the other person. Despatch of electronic record 18. Unless otherwise agreed between the originator and the addressee, the despatch of an electronic record occurs when it enters an information processing system outside the control of the originator or the agent of the originator. Receipt of electronic record 19. The time of receipt of an electronic record shall be determined as follows: (a) if the addressee has designated an information system for the purpose of receiving electronic records, receipt occurs at the time when the electronic record enters the designated information system, or (b) if the addressee has not designated an information system, receipt occurs when the electronic record enters an information system of the addressee through which the addressee retrieves the electronic record. (2) An electronic record is deemed to be despatched at the originator s registered place of business and is deemed to be received at the regis- 12

13 Electronic Transactions Act, 2008 Act 772 tered place where the addressee has its place of business unless otherwise agreed by the originator and the addressee. Expression of intent or other statement 20. An expression of intent or other electronic representation of an electronic record between the originator and the addressee of an electronic record is admissible in circumstances where the intent or other electronic representation is relevant in law. Attribution of electronic records to originator 21. (1) An electronic record is considered to be that of the originator if it was sent by (a) the originator personally, (b) a person who has authority to act on behalf of the originator in respect of that electronic record, or (c) an information system programmed by or on behalf of the originator to operate automatically, unless it is proved that the information system did not properly execute the programme. (2) An addressee is entitled to regard an electronic record as being that of the originator and to act on that assumption, if (a) the addressee properly applied a procedure previously agreed with the originator in order to ascertain whether the electronic record was that of the originator, or (b) the electronic record received by the addressee resulted from the actions of a person whose relationship with the originator or with an agent of the originator enabled that person to gain access to a method used by the originator to identify an electronic record as the originator s own. (3) Where a procedure has not been agreed by both parties to ascertain the originator, the person who appears to be the originator shall be presumed to be the originator. (4) The presumption in subsection (3) does not apply where: (a) the addressee has received notice from the originator that the electronic record was issued without the knowledge or consent of the originator; (b) the addressee knew or should reasonably have known, or used 13

14 Electronic Transactions Act, 2008 any agreed procedure to know that the electronic record was not that of the originator and that the person who sent the electronic record did not have the authority of the originator to issue or send the electronic record; or (c) the addressee knew or should reasonably have known, that the transmission resulted in an error in the electronic record as received. Acknowledgement of receipt of electronic record 22. (1) An acknowledgement of receipt may be given through (a) a communication by the addressee, whether automated or otherwise, or (b) any conduct of the addressee to indicate to the originator that the electronic record has been received. (2) An acknowledgement of receipt is not necessary to give legal effect to a message unless otherwise agreed by the parties. Formation and validity of agreements 23. An agreement is valid even if it was concluded partly or in whole through an electronic medium. Variation by agreement between parties 24. Sections 5 to 23 only apply if the parties involved in generating, sending, receiving, storing or otherwise processing electronic records have not agreed on the issues provided for by these sections. Electronic government services Acceptance of electronic filing and issuing of documents 25. A public body shall take steps or enter into arrangements to ensure that its functions are carried out, delivered or accessed electronically or online. Public agency and electronic records 26. (1) A public agency that, pursuant to any law accepts the filing of documents, requires that documents be created or retained, issues a permit, licence or approval or provides for a payment in accordance with law, may (a) accept the filing of a document, or the creation or retention of documents in the form of an electronic record, (b) issue the permit, licence or approval in the form of an electronic record, or (c) make or receive payment in electronic form or by electronic 14

15 Electronic Transactions Act, 2008 Act 772 means. (2) Any public agency may specify by notice in the Gazette: (a) the manner and format in which the electronic records shall be filed, created, retained or issued; (b) the type of electronic signature required where the electronic record has to be signed; (c) the manner and format in which an electronic signature shall be attached to, incorporated in or otherwise associated with the electronic record; (d) the identity or criteria required of an authentication service provider used by the person filing the electronic record or the public agency may designate an authentication service provider as a preferred authentication service provider; (e) the appropriate control processes and procedures to ensure adequate integrity, security and confidentiality of electronic records or payments; and (f) any other requirements for electronic records or payments. Publication in electronic format 27. (1) Where a law requires publication in the Gazette the requirement is deemed to have been satisfied if published in electronic format referred to as an E-Gazette. (2) The date of publication is deemed to be the date of first publication in the Gazette. Certifying Agency Prohibited acts 28. A person shall not sell or provide encryption or authentication service contrary to the provisions of this Act. Provision of authentication encryption services 29. An encryption or an authentication service or product is deemed to have been provided in the country if it is made available: (a) from premises within the country; (b) from a body incorporated in the country; (c) to a person who is present or operating from any system in the country when that person makes use of the service or product; or (d) from a Ghanaian associated or related domain name or website. 15

16 Electronic Transactions Act, 2008 Certifying Agency 30. (1) The National Information Technology Agency established under National Information Technology Agency Act 2008 (Ac 771) shall facilitate the establishment of the Certifying Agency under this Act. (2) The Certifying Agency shall maintain a website and provide information at the website in accordance with this Act. Functions of the Certifying Agency 31. The functions of the Agency are to: (a) issue licences for encryption and authentication service; (b) monitor the conduct, system and operation of encryption and authentication service providers to ensure compliance with conditions of the licence, and the provisions of this Act; (c) suspend a licence of a licence holder; (d) revoke a licence of a licence holder; and (e) appoint an independent auditing firm to conduct periodic audits of a licence holder to ensure compliance with conditions of the licence and this Act. Revocation or suspension of licence 32. (1) The Agency may suspend or revoke a licence if it is satisfied that the authentication service provider has failed or ceased to meet any of the requirements, conditions or restrictions subject to which the licence was granted or recognition was given. (2) The Agency shall not suspend or revoke a licence unless it has (a) notified the licence holder in writing of its intention to do so, (b) given a description of the alleged breach, and (c) afforded the licensed holder the opportunity to (i) respond to the allegations in writing, and (ii) remedy the alleged breach. (3) The Agency may suspend a licence with immediate effect for a period not exceeding ninety days pending implementation of the procedures required to remedy the breach where there is the likelihood of irreparable harm to consumers or third parties involved in an electronic transaction. (4) A licence holder may surrender the licence to the Agency subject to the provisions of the licence and third party rights. (5) The Agency shall publish the suspension or revocation of a licence in the Gazette. Surrender of licence 16

17 Electronic Transactions Act, 2008 Act (1) A licensee with a suspended or revoked licence shall surrender the licence to the Agency within twenty-four hours of receipt of notice of the suspension or revocation of its licence. (2) Where a licensee fails to surrender the licence, each director of the licensee commits an offence and is liable on summary conviction to a fine of not more than five thousand penalty units for each day that the licence is not surrendered or to a term of imprisonment of not more than two years or to both. Recognition of foreign certifying authorities 34. (1) Subject to the conditions and restrictions that may be specified by law, the Agency may, by notification in the Gazette, recognise a foreign entity as a certifying agency. (2) Where a foreign entity is recognized, as a certifying agency, service and products issued by a person pursuant to the directives of that foreign certifying agency are valid. (3) The Agency by notification in the Gazette may revoke the recognition if it is satisfied that a foreign certifying agency has contravened any of the conditions and restrictions subject to which it was granted recognition. Repository of digital signatures 35. (1) The Agency shall be the repository of Digital Signature Certificates issued under this Act. (2) The Agency shall (a) make use of hardware, software and procedures that are secure from intrusion and misuse, and (b) observe other standards that may be prescribed, to ensure that the secrecy and security of digital signatures are assured. (3) The Agency shall maintain a computerized data base of the public keys to make them verifiable by a member of the public. Register of licence holders 36. (1) The Agency shall establish and maintain a register of licence holders. (2) The Agency shall record the following particulars in respect of each licence holder (a) the name and address of the licence holder, (b) a description of the type of service or product provided, (c) other particulars that may be prescribed to identify and locate 17

18 Electronic Transactions Act, 2008 the license holder or its products or services, (d) licensed encryption and authentication products or services under this Act, (e) licensed encryption and authentication products and services recognised under this Act, (f) suspended and revoked licences or recognition, and (g) any other information that may be prescribed or may be deemed appropriate by the Agency. (3) The Agency shall provide notice of the suspension or revocation at its website. (4) The Agency shall publish the list of licence holders, revoked or suspended licences in electronic and other media, subject to the rules relating to confidentiality. (5) A licence holder shall not be required to disclose confidential information or trade secrets in respect of its products or services. Restrictions on disclosure of information 37. Subject to the provisions of the Constitution, a person may make disclosure of information under this Act (a) to a law enforcement agency, (b) for criminal or civil proceedings, (c) to government agencies responsible for safety and security on official request, and (d) to a third party enquiry for confirmation of a licence or representations made by a licence holder. Application for licence 38. (1) A licence shall not be issued or granted by the Agency to an individual. (2) Each application for the issue of a licence shall be in the prescribed form. (3) Each application for a licence shall be accompanied with, (a) a certificate of incorporation, (b) a statement including the procedures with respect to the identification of the applicant. (c) payment of a non-refundable application fee, and (d) other prescribed documents. (4) The Agency shall take the following factors into account in considering an application: 18

19 Electronic Transactions Act, 2008 Act 772 (a) the financial and human resources, including the assets of an applicant; (b) the quality of the applicants hardware and software systems; (c) procedures for processing products or services; (d) the availability of information to third parties relying on the authentication product or service; (e) the regularity and extent of audits by an independent body; and (f) any other relevant factor which may be prescribed or which the Agency may consider necessary. (5) A licence is valid for the period and on the terms and conditions that may be determined by the Agency. Grant of licence 39. (1) The Agency shall not grant a licence under this Act unless the Agency is satisfied that a security procedure related to or issued by an applicant, (a) is uniquely linked to the user, (b) is capable of identifying that user, (c) is created using means that can be maintained under the sole control of that user, and (d) will be linked to the electronic record to which it relates so that any subsequent change of the electronic record is detectable. (2) The Agency may, prior to licensing any authentication products or services, stipulate: (a) the technical and other requirements to be met by certificates issued by the licence holder; (b) the requirements for issuing certificates; (c) the requirements for certification practice statements; (d) the responsibilities of the certification service provider; (e) the liability of the certification service provider; (f) the records to be kept and the manner in which and length of time for which they must be kept; (g) requirements concerning certificate suspension and revocation procedures; (h) requirements as to notification procedures relating to certificate suspension and revocation; and 19

20 Electronic Transactions Act, 2008 (i) other conditions or restrictions that the Agency may consider necessary. (3) A licence is not transferable. Display of licence 40. A licensee shall display its licence conspicuously on the premises of its principal place of business. Duties of licensed entities 41. A licensee shall ensure that each person employed or engaged by it complies with the provisions of this Act, Regulations made under this Act and the licence conditions. Renewal of licence 42. An application for renewal of a licence shall be (a) in the form, and (b) accompanied with the fees prescribed and shall be paid in full before the issue of a licence. Procedure for grant or rejection of renewal of licence 43. (1) The Agency may grant or reject the application for the renewal after considering the documents accompanying the application for renewal and other factors considered necessary. (2) The Agency shall provide reasons for the rejection of the application in writing to the applicant. Notification of adverse event 44. The Agency shall (a) use reasonable efforts to notify any person who is likely to be affected by the occurrence of an adverse event, or (b) deal with the event or situation in accordance with the procedure specified in its certification practice statement where in the opinion of the Agency an event has occurred or a situation has arisen which may materially and adversely affect the integrity of its computer system or the conditions subject to which a licence was granted. Procedures to be followed by licensed person 45. A licensed person shall (a) make use of hardware, software and procedures that are secure from intrusion and misuse, (b) provide such level of reliability in its services which are reasonably suited to the performance of the intended functions, 20

21 Electronic Transactions Act, 2008 Act 772 (c) adhere to security procedures to ensure that the secrecy and privacy of the product or service are assured, and (d) adhere to such security procedures and observe such other standards as may be prescribed. Consumer protection Scope of application 46. Sections 47 to 54 apply only to electronic transactions. Information to be provided 47. (1) The supplier offering goods or services for sale, hire or exchange in an electronic transaction shall make available to the consumer on the electronic platform where the goods or services are offered the following information related to the supplier: (a) full name and legal status; (b) physical address and telephone number; (c) website address and address; (d) membership of any self-regulatory or related bodies and the contact details of the body; (e) a code of conduct to which that supplier subscribes and how that code of conduct may be accessed electronically by the consumer; (f) the registration number, the names of office bearers and the place of registration of a legal person; (g) sufficient description of the main characteristics of the goods or services offered by that supplier to enable a consumer to make an informed decision on the proposed electronic transaction; (h) the full price of the goods or services, including transport costs, taxes and any other fees or costs; (i) the manner of payment; (j) terms of agreement including guarantees that will apply to the transaction and how these terms may be accessed, stored and reproduced electronically by consumers; (k) the time within which the goods will be despatched or delivered or within which the services will be rendered; (l) the manner and period within which consumers can access and maintain a full record of the transaction; (m) the return, exchange and refund policy; 21

22 Electronic Transactions Act, 2008 (n) the alternative dispute resolution code to which that supplier subscribes and access to the code by the consumer; (o) the security procedures and privacy policy of that supplier as regards payment, payment information and personal information; (p) the minimum duration of the agreement in the case of agreements for the supply of products or services to be performed on an ongoing basis or recurrently where appropriate; and (q) the rights of consumers as provided for in this section. (2) The supplier shall provide a consumer with an opportunity to (a) read, store and reproduce the contract terms and general conditions, (b) identify and correct handling errors, and (c) withdraw from the transaction before concluding a contract. (3) If a supplier fails to comply with the provisions of this section, the consumer may cancel the contract within fourteen days of receipt of the goods or services under the transaction. (4) If a transaction is cancelled as a result of the failure of the supplier to comply with the provisions of this section (a) the consumer shall return the goods received, or where applicable, cease using the services performed, and (b) the supplier shall refund payments made by the consumer within thirty days. (5) The supplier shall utilise a payment system that is sufficiently secure with reference to accepted technological standards at the time of the transaction and the type of transaction concerned. (6) The supplier is liable for damage suffered by a consumer due to failure by the supplier to apply a secure payment system. Performance 48. (1) The supplier shall execute the order within fourteen days after the day on which the supplier receives the order, unless the parties have agreed otherwise. (2) Where a supplier fails to execute the order within the fourteen days or within the agreed period, the contract is voidable. (3) If a supplier is unable to perform on the grounds that the goods 22

23 Electronic Transactions Act, 2008 Act 772 or services ordered are unavailable, the supplier shall immediately notify the consumer of this fact and refund any payment within seven days after the date of notification. Grace period 49. (1) A consumer is entitled to cancel a transaction and any related credit agreement for the supply (a) of goods within fourteen days after the date of the receipt of the goods, or (b) of services within seven days after the date of the conclusion of the agreement, without reason and without penalty. (2) The only charge that may be levied on the consumer is the direct cost of returning the goods. (3) This section shall not be construed to limit the rights of a consumer provided for in any other law. (4) This section does not apply to an electronic transaction: (a) for financial services, including but not limited to, investment services, insurance and reinsurance operations, banking services and operations relating to dealings in securities; (b) by way of an auction; (c) for the supply of foodstuffs, beverages or other goods intended for everyday consumption supplied to the home, residence or workplace of the consumer; (d) for services which began with the consumer s consent before the end of the seven-day grace period; (e) where the price for the supply of goods or services is dependent on fluctuations in the financial markets and which cannot be controlled by the supplier; (f) where the goods (i) are made to the consumer s specification, (ii) by reason of their nature cannot be returned, or (iii) are perishable; (g) where audio or video recordings or computer software were unsealed by the consumer; (h) for the sale of newspapers, periodicals, magazines and books; (i) for the provision of gaming and lottery services; or 23

24 Electronic Transactions Act, 2008 (j) for the provision of accommodation, transport, catering or leisure services where the supplier has commenced the provision of these services on a specific date or within a specific period. Unsolicited goods, services or communications 50. (1) Except in the case of a notice sent by an electronic communications provider to a customer in relation to the service, a person shall not send unsolicited electronic communications to a consumer without obtaining the prior consent of the consumer. (2) A person who sends electronic commercial communication to a consumer shall provide the consumer (a) with the option to cancel the subscription to the mailing list of that person, and (b) with the identifying particulars of the source from which that person obtained the consumer s personal information at the request of the consumer. (3) An agreement shall not be deemed to have been concluded where a consumer fails to respond to an unsolicited communication; and the consumer is entitled to recover the costs associated with the cancellation of unsolicited communication. (4) A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a fine of not more than five thousand penalty units or a term of imprisonment of not more than ten years or to both. (5) A person who sends unsolicited commercial communications to another person or who continues to send unsolicited commercial communications after cancellation of the subscription commits an offence and is liable on summary conviction to a fine of not more than five thousand penalty units or a term of imprisonment of not more than ten years or to both. Liability for misuse of electronic payment medium 51. (1) A holder of an electronic payment medium shall not, unless acting in collusion with another person, be liable to the issuer for loss arising from use of the medium by a person who is not acting or being treated as acting as the agent of the holder. 24

25 Electronic Transactions Act, 2008 Act 772 (2) Subsection (1) does not prevent (a) the holder of the electronic payment medium from being made liable for loss to the issuer arising from use of the medium by another person during a period beginning when the medium ceases to be in the possession of an authorised person and ending when the medium is once more in the possession of an authorised person, or (b) the holder from being made liable to any extent for loss to the issuer from use of the medium by a person who acquired possession of it with the holder s consent. (3) Subsections (2) does not apply to the use of the electronic payment medium after the issuer has been given notice of loss and does not apply unless the issuer provides the holder with particulars of the name, address and telephone number of a person stated to be the person to whom notice is to be given. (4) The notice takes effect when received, but where it is given orally, shall be confirmed in writing within fourteen clear days. (5) A sum paid by the holder for the issue of the electronic payment medium is treated as paid towards satisfaction of liability under this section to the extent that it has not been previously offset by use made of the medium. (6) The holder or a person authorised by the holder to use the electronic payment medium is an authorised person for the purpose of subsection (2). Electronic payment medium lists prohibited 52. (1) A financial institution shall not (a) make available, (b) lend, or (c) sell any list or portion of a list of holders of an electronic payment medium and their addresses and account numbers to any person without the prior written consent of the holders except by order of a Court. (2) A financial institution may make available to another financial institution information about an electronic payment medium holder s credit rating without the holder s prior written consent if written notice 25

26 Electronic Transactions Act, 2008 of the disclosure is given to the holder within seven days subject to any law regulating credit rating institutions. (3) A financial institution which contravenes subsection (1) commits an offence and each director and officer of the institution who fails to ensure compliance with this Act is liable on summary conviction to a fine of not more than two thousand five hundred penalty units or imprisonment for a term of not more than five years or to both. Applicability of foreign law 53. Despite a provision of an agreement to the contrary, the supply of goods pursuant to a contract to consumers in this country is subject to the provisions of this Act. Non-exclusion 54. A provision in an agreement which excludes consumer rights provided for in this Act is void. Protected computers and critical database Protected computer 55. (1) The Minister may declare that a computer, computer system or computer network is a protected system by notification in the Gazette. (2) The Minister may authorise access to a protected system by or in writing. (3) Until the Minister by Gazette publication declares a computer, computer system or computer network to be a protected system, the computer, computer system or computer network shall be treated as a protected computer if the computer, program or electronic record is used directly in connection with or for (a) the security, defence or international relations of the country; (b) the existence or identity of a confidential source of information related to the enforcement of criminal law; (c) the provision of services directly related to communications infrastructure, banking and financial services, public utilities, public transportation or public key infrastructure; (d) the protection of public safety and public health, including systems related to essential emergency services; (e) foreign commerce or communication affecting a citizen of Ghana or business in which a citizen of Ghana or the Government has an interest; or 26

27 Electronic Transactions Act, 2008 Act 772 (f) the legislative, executive or judicial service, the public services and security agencies. (4) A person who secures access or attempts to secure access to a protected system in contravention of the provisions of this section commits an offence and is liable on summary conviction to a fine of not more than five thousand penalty units or imprisonment for a term of not more than ten years or to both. Identification of critical electronic record and critical databases 56. The Minister may by notice in the Gazette (a) declare certain classes of information which are of importance to the protection of the national security of the Republic or the economic and social well-being of its citizens to be critical electronic records for the purpose of this Act, and (b) establish a procedure to be followed in the identification of critical databases for the purposes of this Act. Scope of critical database protection 57. The Minister may declare certain classes of information relating to national security or the economic or social wellbeing of the public to be critical electronic record for the purposes of sections 58 to 62. Registration of critical databases 58. (1) The Minister may by notice in the Gazette determine (a) requirements for the registration of a critical database, (b) procedures for the registration of a critical database, and (c) any other matter relating to registration. (2) Registration of a critical database means recording the following information: (a) the full name, address and contact details of the critical database administrator; (b) the location of the critical database, including the locations of the component parts where a critical database is not stored at a single location; and (c) a general description of the categories or types of information stored in the critical database. Management of critical databases 59. (1) The Minister shall prescribe minimum standards for prohibitions in respect of (a) the general management of a critical database, 27

28 Electronic Transactions Act, 2008 it considers necessary for the protection of national security. Domain name registry Establishment of Registry 63. (1) There is established by this Act a Domain Name Registry. (2) The Registry is a body corporate with perpetual succession and a common seal and may sue and be sued in its corporate name. (3) The Registry may be converted into a company limited by guarantee on the same terms and conditions as provided under this Act. (4) The Registry is a non-profit making entity. Functions of the Registry 64. (1) The Registry is responsible for the country domain name space from a date to be determined by the Minister by notice in the Gazette and shall (a) administer and manage the country domain name space; (b) comply with international best practice in the administration of the.gh domain name space; (c) license and regulate registries; (d) license and regulate registrars for the respective registries; and (e) publish guidelines on (i) the general administration and management of the.gh domain name space, (ii) the requirements and procedures for domain name registration, and (iii) the maintenance of and public access to a repository, with due regard to the policy directives which the Minister may give from time to time by notice in the Gazette. (2) After the assumption of responsibility for the country domain space, a person shall not do anything or operate the country domain name or any domain name associated with the country except as provided under this Act. (3) A person who contravenes this section commits an offence and is liable on summary conviction to a fine of not more than five hundred penalty units or to a term of imprisonment of not more than three years or to both. Duties of the Registry 65. (1) The Registry shall enhance public awareness on the economic 28

29 Electronic Transactions Act, 2008 Act 772 (b) access to, transfer and control of a critical database, (c) infrastructural or procedural rules and requirements to secure the integrity and authenticity of a critical electronic record, (d) procedures and technological methods to be used in the storage or archiving of a critical database, (e) accident recovery plans in the event of loss of critical data bases or parts of the database, (f) the security of the databases, (g) the physical safety of a person in control of the critical database, and (h) any other matter required for the adequate protection, management and control of a critical database. (2) This Act shall not be construed to limit the right of a public body to perform an authorised function in terms of any other law. Restrictions on disclosure of information 60. (1) Information contained in the register of a critical database shall not be disclosed to another person other than to employees of the Agency who are responsible for the keeping of the register. (2) The Agency is at liberty to disclose information to (a) a law enforcement agency, and (b) a Ministry, Department or Agency. (3) Nothing in this law shall preclude the Agency from pleading in proceedings relating to information held in its custody or records that production or disclosure of a matter may be prejudicial to the security of the State or injurious to the public interest in accordance with article 135 of Constitution. Right of inspection 61. The Minister may cause audits to be carried out by a critical database administrator to evaluate compliance with the provisions of this Act. Non-compliance with Act 62. (1) The Minister on receipt of the audit report shall consider, (a) any action recommended to remedy the non-compliance, and (b) the period within which the remedial action shall be performed. (2) The Minister shall report the recommendation to the National Security Council and the Council may take action or give directions that 29